How to fix Error: crypto.randomBytes() failed (entropy source unavailable) in Node.js

Node.jsINTERMEDIATEHIGHUpdated Dec 9, 2025· 138 views

This error occurs when Node.js cannot access sufficient system entropy to generate cryptographically secure random bytes. It typically happens on systems with depleted entropy pools, especially right after boot, in containerized environments, or on systems with limited hardware entropy sources.

Quick fix

Fixes Error: crypto.randomBytes() failed (entropy source unavailable)

cat /proc/sys/kernel/random/entropy_avail
  1. Verify entropy availability on Linux
  2. Install entropy-gathering daemon (Linux)
  3. Configure Docker container with entropy access
  4. Use async version to avoid blocking
node.js — error
cat /proc/sys/kernel/random/entropy_avail
Error: crypto.randomBytes() failed (entropy source unavailable)

What this error means

This error indicates that the system's entropy pool—the source of environmental randomness used for cryptographic operations—is unavailable or depleted. Node.js's `crypto.randomBytes()` relies on OpenSSL, which in turn depends on the operating system's random number generator (typically `/dev/urandom` on Unix-like systems or the Windows Cryptographic API). When the entropy source is unavailable, it usually means the system hasn't gathered enough random data from environmental noise (keyboard input, mouse movements, disk I/O, network activity) to safely generate cryptographically strong random bytes. This is most common immediately after system boot when the entropy pool hasn't been initialized yet. In containerized or virtualized environments, entropy gathering can be particularly challenging because these systems often lack direct access to hardware entropy sources and have limited user interaction, making it harder to accumulate sufficient randomness.

Typical symptoms

  • Application crashes or hangs when calling crypto.randomBytes()
  • Error occurs consistently on server startup or container initialization
  • System appears to block indefinitely when generating random data
  • Issue happens more frequently in Docker containers or VMs
  • Error appears right after system boot and resolves after some time

Common causes

  1. System entropy pool is depleted or not yet initialized after boot
  2. Running in containerized environment (Docker, Kubernetes) with limited entropy sources
  3. Virtual machine without proper entropy gathering mechanisms configured
  4. High-frequency crypto operations exhausting available entropy
  5. Operating system lacks entropy-gathering daemons (haveged, rng-tools)
  6. Restricted access to /dev/random or /dev/urandom on Unix systems

How to fix "Error: crypto.randomBytes() failed (entropy source unavailable)"

1Verify entropy availability on Linux

Check the current entropy pool status:

bash
cat /proc/sys/kernel/random/entropy_avail

A healthy system should show values above 1000. Values below 200 indicate low entropy. You can also monitor entropy in real-time:

bash
watch -n 1 cat /proc/sys/kernel/random/entropy_avail
2Install entropy-gathering daemon (Linux)

Install haveged to ensure continuous entropy generation:

Ubuntu/Debian:

bash
sudo apt-get update
sudo apt-get install haveged
sudo systemctl enable haveged
sudo systemctl start haveged

CentOS/RHEL:

bash
sudo yum install haveged
sudo systemctl enable haveged
sudo systemctl start haveged

Verify it's running:

bash
sudo systemctl status haveged
3Configure Docker container with entropy access

If running in Docker, ensure the container has access to the host's entropy:

dockerfile
# Dockerfile - mount host's urandom device
FROM node:20-alpine
# Your app setup...

Or run with device mapping:

bash
docker run -v /dev/urandom:/dev/random your-image

For docker-compose:

yaml
services:
  app:
    image: your-image
    devices:
      - "/dev/urandom:/dev/random"
4Use async version to avoid blocking

Always use the asynchronous version of randomBytes to prevent blocking the event loop:

javascript
const crypto = require('crypto');

// Good - async with callback
crypto.randomBytes(32, (err, buffer) => {
  if (err) {
    console.error('Error generating random bytes:', err);
    return;
  }
  const token = buffer.toString('hex');
  console.log('Token:', token);
});

// Good - async with promises
const { promisify } = require('util');
const randomBytesAsync = promisify(crypto.randomBytes);

async function generateToken() {
  try {
    const buffer = await randomBytesAsync(32);
    return buffer.toString('hex');
  } catch (err) {
    console.error('Error generating random bytes:', err);
    throw err;
  }
}

Avoid the synchronous version which will block:

javascript
// Avoid - can block the entire process
const buffer = crypto.randomBytesSync(32);
5Add retry logic with exponential backoff

Implement retry logic for transient entropy issues:

javascript
const crypto = require('crypto');
const { promisify } = require('util');
const randomBytesAsync = promisify(crypto.randomBytes);

async function generateRandomBytes(size, maxRetries = 3) {
  for (let attempt = 0; attempt < maxRetries; attempt++) {
    try {
      return await randomBytesAsync(size);
    } catch (err) {
      if (err.message.includes('entropy') && attempt < maxRetries - 1) {
        const delay = Math.pow(2, attempt) * 1000; // 1s, 2s, 4s
        console.log(`Entropy unavailable, retrying in ${delay}ms...`);
        await new Promise(resolve => setTimeout(resolve, delay));
      } else {
        throw err;
      }
    }
  }
}

// Usage
generateRandomBytes(32)
  .then(buffer => console.log('Generated:', buffer.toString('hex')))
  .catch(err => console.error('Failed after retries:', err));
6Configure rng-tools for virtual machines

For VMs, install and configure rng-tools to use hardware RNG if available:

bash
# Install rng-tools
sudo apt-get install rng-tools

# Check if hardware RNG is available
ls -l /dev/hwrng

# Edit configuration to use hardware RNG
sudo nano /etc/default/rng-tools
# Add: HRNGDEVICE=/dev/hwrng

# Restart service
sudo systemctl restart rng-tools
sudo systemctl enable rng-tools

For VirtualBox VMs, enable the virtual RNG:

bash
VBoxManage modifyvm "VM-Name" --vrde on
VBoxManage modifyvm "VM-Name" --vrdeextpack default

Advanced notes

Entropy Sources Deep Dive:
On Linux systems, /dev/random blocks when entropy is low, while /dev/urandom does not. Modern Linux kernels (4.8+) use a cryptographically secure pseudo-random number generator (CSPRNG) that doesn't deplete entropy in the traditional sense. Node.js's crypto module uses OpenSSL, which typically reads from /dev/urandom on Unix systems.

Container-Specific Considerations:
Containerized applications face unique entropy challenges because they share the host kernel's entropy pool but have limited ways to contribute to it (no keyboard, mouse, or direct hardware access). Solutions include:
- Using rng-tools or haveged on the host system
- Mapping the host's /dev/urandom to the container
- Using Kubernetes with entropy-aware scheduling

Kubernetes Solutions:
For Kubernetes deployments, consider using init containers to verify entropy before starting the main application, or use sidecars that monitor and report entropy levels.

Security Implications:
Never work around this error by using non-cryptographic random sources like Math.random() for security-sensitive operations (tokens, keys, salts). This would completely compromise the security of your application. Always address the underlying entropy issue.

Windows Considerations:
On Windows, Node.js uses the Windows Cryptographic API (CryptoAPI), which has its own entropy sources. This error is less common on Windows systems but can still occur in certain virtualized scenarios.

Frequently asked questions

What does "Error: crypto.randomBytes() failed (entropy source unavailable)" mean?
This error indicates that the system's entropy pool—the source of environmental randomness used for cryptographic operations—is unavailable or depleted. randomBytes() relies on OpenSSL, which in turn depends on the operating system's random number generator (typically /dev/urandom on Unix-like systems or the Windows Cryptographic API). When the entropy source is unavailable, it usually means the system hasn't gathered enough random data from environmental noise (keyboard input, mouse movements, disk I/O, network activity) to safely generate cryptographically strong random bytes.
How do I fix "Error: crypto.randomBytes() failed (entropy source unavailable)"?
This error occurs when Node.js cannot access sufficient system entropy to generate cryptographically secure random bytes. It typically happens on systems with depleted entropy pools, especially right after boot, in containerized environments, or on systems with limited hardware entropy sources.
What causes "Error: crypto.randomBytes() failed (entropy source unavailable)"?
System entropy pool is depleted or not yet initialized after boot Running in containerized environment (Docker, Kubernetes) with limited entropy sources Virtual machine without proper entropy gathering mechanisms configured
Is the "Error: crypto.randomBytes() failed (entropy source unavailable)" error serious?
Yes. This is a high-severity error that usually blocks work until it is fixed, but the steps above resolve it.

Official resources & further reading